The Spanner logo
    • Home
    • Blog
      • Blog home
      • RSS
    • Login
    • Home
    • Blog
      • Blog home
      • RSS
    • Login
    The Spanner logo

    The Spanner
    Web security blog

    Made by Gareth Heyes
    Follow me on Twitter: @garethheyes

    Javascript for hackers!

    Hackvertor logo
    Shazzer logo
    My Github account
    Recent posts
    Introducing Feedworm: A Privacy-First RSS Reader That Lives in DevToolsSpeedy RSVP extensionAutoVaderHackvertor history and tag finderShadow Repeater v1.2.3 releaseBurp Hackvertor v2.1.24 releaseHacking roomsXSSing TypeErrors in SafarivalueOf: Another way to get thisMaking the Unexploitable Exploitable with X-Mixed-Replace on FirefoxThe curious case of the evt parameterCSS-Only Tic Tac Toe ChallengeRewriting relative urls with the base tag in SafariBypassing DOMPurify with mXSSNew IE mutation vectorHow I smashed MentalJSMentalJS DOM bypassAnother XSS auditor bypassXSS Auditor bypassBypassing the IE XSS filterUnbreakable filterMentalJS bypassesmXSSJava SerializationBypassing the XSS filter using function reassignmentRPOSandboxed jQueryX-Domain scroll detection on IE using focusEpic fail IEnew operatorDecoding complex non-alphanumeric JavaScriptHacking FirefoxDOM ClobberingBypassing XSS AuditorThe evolution of codeNon-Alpha PHP in 6-7 charsetTweetable PHP-Non AlphaMentalJS for PHPOpera x domain with video tutorialSandboxing and parsing jQuery in 100ms

    Calling the Array constructor in IE

    By Gareth Heyes (@hackvertor)

    Published 17 years 5 months ago • Last updated March 22, 2025 • ⏱️ < 1 min read

    ← Back to articles

    I had a conversation a while ago on email with Billy Hoffman about how in IE the Array constructor wasn't called when using [] to create arrays. The question is, was he right? Technically yes but actually no :)

    You see Arrays in JScript are actually objects and not arrays, so trying to overwrite the Array constructor will have no effect. However using the Object constructor does. I found this while hacking away in JSON to create my Twitter POC.

    The is a strange quirk which although it technically is the same code it results in different behaviour. Take the following example:-

    <pre lang="javascript"> function Object() { alert(arguments[0]); } ([1,2,3]); </pre>

    That doesn't work but...look at this example:-

    <pre lang="javascript"> var Object = function() { alert(arguments[0]); } ([1,2,3]); </pre>

    It works! Yay! Strange but true. Don't ask how I found this but it was either by fuzzing, playing around in Hackvertor or pure luck :)

    ← Back to articles